CVE-2020-7968: 
GitLab vulnerability analysis and mitigation

GitLab Enterprise Edition (EE) versions 8.0 through 12.7.2 were affected by an incorrect access control vulnerability identified as CVE-2020-7968. The vulnerability involved authorization checks not being properly applied in cases where public repositories had merge request visibility set to members only, potentially resulting in unauthorized disclosure of source code from forked private projects (GitLab Release).

The vulnerability was classified with a CVSS v3.1 score of 7.5 (HIGH) and a CVSS v2.0 score of 5.0 (MEDIUM). The core issue stemmed from improper implementation of access control mechanisms in GitLab's handling of merge request visibility settings (NVD Results).

The vulnerability could lead to the disclosure of source code from forked private projects, potentially exposing sensitive information to unauthorized users. This security flaw specifically affected scenarios where public repositories had their merge request visibility configured to members only (GitLab Release).

The vulnerability was discovered and reported responsibly by security researcher @ngalog. While specific exploit details were not publicly disclosed, the issue affected all previous GitLab versions until it was patched (GitLab Release).

The vulnerability was addressed in GitLab versions 12.7.4, 12.6.6, and 12.5.9. GitLab strongly recommended that all installations running affected versions be upgraded to the latest version as soon as possible to mitigate the security risk (GitLab Release).